Privacybeleid

Laatst bijgewerkt: 23 oktober 2026

Dit document is alleen in het Engels beschikbaar. De Engelse tekst is bindend.

This Privacy Policy explains how Helium Rooms ("we", "us", "our") processes personal data under the General Data Protection Regulation (GDPR).

1. Who We Are

Helium Rooms is operated by Lighthouse Intelligence, a sole proprietorship (eenmanszaak) registered in the Netherlands.

Address: Onderduikersstraat 72, 9727 CX Groningen, The Netherlands
Chamber of Commerce (KvK): 75754355
Email: support@heliumrooms.com

We are a small business and have not appointed a data protection officer. Privacy questions can be sent to support@heliumrooms.com.

2. Our Two Roles

  • Controller: for the accounts of our customers, our website, billing, support, and our own analytics and error monitoring.
  • Processor: for the content of rooms (data synced from Linear, comments, requests, votes, files) and the people in them, which we process on behalf of the organization that runs the room. That processing is governed by our Data Processing Agreement. If you visit a room, the organization that invited you or runs the room is responsible for that data, and you can contact them first. We will help them answer your request.

3. Personal Data We Process

  • Account information: name, email address, company name
  • Authentication data: password hash, login codes, session tokens
  • Room content: issues and comments synced from Linear, and comments, requests, votes, approvals and files added in rooms, including the names and email addresses of the people involved
  • Room visitor data: name and email address when a visitor logs in, registers or subscribes to updates, and an anonymous identifier for visitors who do not log in
  • Usage data: IP address, browser and device type, pages visited and actions taken in the Service
  • Error data: technical details of errors and, for a sample of sessions and for sessions in which an error occurs, a recording of the page structure with all text masked and all images and media blocked
  • Billing data: processed by Stripe; we do not store card details
  • Support correspondence

4. Purposes and Legal Bases

  • Providing the Service, accounts and rooms, and sending the emails that belong to it (login codes, invitations, notifications and digests you can unsubscribe from): performance of a contract. For room content we act as processor, and the organization that runs the room relies on its own legal basis
  • Security, abuse prevention and rate limiting: legitimate interest
  • Product analytics (see section 5): legitimate interest in understanding and improving the Service, and consent for analytics cookies in your browser
  • Error monitoring and session recordings: legitimate interest in finding and fixing errors
  • AI-assisted drafting of release notes, when an account owner uses it: performance of a contract
  • Understanding how customers found us (first-visit attribution, see section 5): legitimate interest
  • Billing and tax records: legal obligation
  • Customer support: performance of a contract

5. Cookies, Local Storage and Analytics

  • Necessary: cookies and local storage for login sessions, preferences and your cookie choice. These do not need consent.
  • Analytics in your browser: PostHog cookies and browser tracking are only used after you accept them in the cookie banner. You can change your choice at any time through the "Cookie settings" link at the bottom of our website.
  • Analytics on our servers: regardless of your cookie choice, our servers send PostHog events about how the Service is used, such as signing up, creating a room or viewing a room. These events are linked to an account or anonymous identifier and can include your email address, company name, the names of rooms and organizations, and the landing page, referrer and campaign of your first visit.
  • First-visit attribution: on your first visit, your browser's local storage keeps the page you landed on, the site that referred you and any campaign tags. It is only sent to us if you sign up.
  • Page view log: for our marketing website we keep a cookie-free page view log in which IP addresses are replaced by a hash.
  • Error monitoring: Sentry collects error data and records sessions as described in section 3, using your browser's session storage.

6. Who Receives Personal Data

We use the following service providers:

  • Vercel Inc.: application hosting
  • Supabase Inc.: database and authentication
  • Backblaze Inc.: file storage and database backups (Amsterdam, the Netherlands)
  • GitHub Inc.: runs our nightly database backup job (United States)
  • Resend Inc.: sending email (United States)
  • PostHog Inc.: product analytics (EU hosting)
  • Functional Software Inc. (Sentry): error monitoring and session recordings (EU hosting, Germany)
  • Stripe Payments Europe Ltd: payment processing and invoicing (Ireland; Stripe acts as an independent controller for payment data)
  • Anthropic PBC: AI-assisted drafting of release notes. When an account owner uses it, we send the text they write and the titles and descriptions of the Linear issues and project updates they select (United States; not used to train AI models)

Other recipients:

  • Linear: when an organization connects its Linear workspace, we read data from it and write input from its rooms back into that workspace: comments, requests, votes, attached files, and the name or email address of the person who submitted them. We also create customer records there, named after that person's company domain or email address. Linear processes that data under its own agreement with that organization.
  • Content loaded in your browser: profile pictures of Linear users (hosted by Linear or services such as Google or Gravatar), the emoji picker's data from the jsDelivr network, and any videos or pages an organization embeds in its room (for example from YouTube or Loom) are loaded directly from those providers, which receive your IP address and browser details.
  • Authorities, when we are legally required to share data.

We do not sell personal data.

7. International Transfers

Some sub-processors are based in the United States or can access data from there, even when the data is stored in the EU. For these transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the EU Standard Contractual Clauses in the provider's data processing terms. You can ask us for a copy of the relevant safeguards.

8. Retention

  • Account data and room content: as long as the account exists. We delete it within 30 days after a request or after the account is closed, and may delete the data of long-inactive accounts as described in our Terms.
  • Database backups: up to 60 days, after which they are deleted automatically.
  • Error data and session recordings: up to 90 days.
  • Analytics events: as long as needed to analyse use of the Service, and never longer than our analytics provider's maximum retention.
  • Page view log: 12 months.
  • Rate-limiting records (which can contain an email address or IP address): 7 days.
  • Billing records: 7 years, as required by Dutch tax law.
  • Support correspondence: as long as needed to handle the request.

9. Security

We use technical and organizational measures to protect personal data, including encryption in transit, access control per organization at database level, limited administrative access and daily backups.

9a. Data Breaches

If a breach affects data we process on behalf of an organization, we notify that organization without undue delay so it can meet its own obligations. If a breach affects data for which we are controller, we notify the Dutch Data Protection Authority and the people affected where the law requires it.

10. Your Rights

  • Right of access
  • Right to rectification
  • Right to erasure
  • Right to restriction
  • Right to data portability
  • Right to object, including to processing based on legitimate interest
  • Right to withdraw consent at any time
  • Right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)

10a. Exercising Your Rights

You can exercise your rights by emailing support@heliumrooms.com. We respond within one month, unless an extension is permitted by law. For room content, see section 2.

11. Children

The Service is meant for business use. We do not knowingly collect personal data from anyone under 16.

12. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

13. Changes

We may update this Privacy Policy. The date at the top shows the latest version. We notify account owners by email of material changes.

14. Contact

For questions about this Privacy Policy, contact:
support@heliumrooms.com